CVE-2023-5901 - Vulnerability Details - OpenCVE

Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sfu	Pkp Web Application Library

Configuration 1 [-]

cpe:2.3:a:sfu:pkp_web_application_library:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23
https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2023-11-01T00:00:42.521Z

Updated: 2024-08-02T08:14:24.974Z

Reserved: 2023-11-01T00:00:37.952Z

Link: CVE-2023-5901

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-11-07T04:24:31.807

Modified: 2024-11-21T08:42:44.220

Link: CVE-2023-5901

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5901", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntrdev", "dateReserved": "2023-11-01T00:00:37.952Z", "datePublished": "2023-11-01T00:00:42.521Z", "dateUpdated": "2024-08-02T08:14:24.974Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "pkp/pkp-lib", "vendor": "pkp", "versions": [{"lessThan": "3.3.0-16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.</p>"}], "value": "Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2023-11-16T21:10:09.782Z"}, "references": [{"url": "https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597"}, {"url": "https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23"}], "source": {"advisory": "8fb9b06b-cadd-469e-862d-5ce026019597", "discovery": "EXTERNAL"}, "title": "Cross-site Scripting in pkp/pkp-lib", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:14:24.974Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597", "tags": ["x_transferred"]}, {"url": "https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sfu:pkp_web_application_library:*:*:*:*:*:*:*:*", "matchCriteriaId": "60CE0E67-FCF5-4A26-A91E-514946B97D99", "versionEndExcluding": "3.3.0-16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.\n\n"}, {"lang": "es", "value": "Carga sin restricciones de archivos con tipo peligroso en el repositorio de GitHub pkp/pkp-lib anterior a 3.3.0-16."}], "id": "CVE-2023-5901", "lastModified": "2024-11-21T08:42:44.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "security@huntr.dev", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-07T04:24:31.807", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/pkp/pkp-lib/commit/44d8bde60eb2575fd4087b76540aec9b49389e23"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/8fb9b06b-cadd-469e-862d-5ce026019597"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}